Skip to content
skopnix
Detections · Rule
← IBM QRadar detectionsIBM QRadar · Behaviour (ATT&CK technique)

rclone copy or sync to remote storage (T1567.002)

AQLmediumconfidence 70/100generated 2026-10-18

rclone.exe copying or syncing data to a remote — the exfiltration tool of choice for data-theft extortion crews. Observed for: APT27, APT31, APT40, BRONZE STARLIGHT, Chimera, Confucius and 17 more.

ATT&CK
T1567.002 mitre ↗
Linked actors
APT27 · APT31 · APT40 · BRONZE STARLIGHT · Chimera · Confucius · Contagious Interview · Earth Lusca · HAFNIUM · INDRIK SPIDER · Kimsuky · LYCEUM · Medusa Group · MuddyWater · MUSTANG PANDA · POLONIUM · SaintBear · Scattered Spider · Storm-0501 · Storm-1567 · ToddyCat · Turla · WIZARD SPIDER
False positives
Matches only rclone running copy/sync; listing, config and mount do not match. Renamed rclone binaries are not covered by the Cortex/QRadar versions (Sigma also checks the PE description).

AQL search

skopnix-qradar-ttp-t1567-002-21513025.aqldownload .aql ↓
SELECT DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time, LOGSOURCENAME(logsourceid) AS log_source, sourceip, username, "Process Name", "Process CommandLine"
FROM events
WHERE "Process Name" ILIKE 'rclone.exe' AND ("Process CommandLine" ILIKE '% copy %' OR "Process CommandLine" ILIKE '% sync %')
LAST 7 DAYS

CRE rule (build in Offenses > Rules)

download .txt ↓
Rule name: "Skopnix: rclone copy or sync to remote storage (T1567.002)"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [Microsoft Windows Security Event Log, Microsoft Windows Sysmon]
  - and when the event matches this AQL filter query: "Process Name" ILIKE 'rclone.exe' AND ("Process CommandLine" ILIKE '% copy %' OR "Process CommandLine" ILIKE '% sync %')
Response: dispatch new event / create offense indexed by Source IP; annotate "Skopnix T1567.002".
FP-safety: Matches only rclone running copy/sync; listing, config and mount do not match. Renamed rclone binaries are not covered by the Cortex/QRadar versions (Sigma also checks the PE description).

How to deploy on IBM QRadar

  1. 1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
  2. 2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
  3. 3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.

Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.

References